PT-2023-8230 · Rabbitmq+1 · Rabbitmq Java Client+1
Liankee
·
Publicado
2023-10-24
·
Atualizado
2026-05-18
·
CVE-2023-46120
CVSS v2.0
6.1
Média
| Vetor | AV:N/AC:L/Au:M/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
RabbitMQ Java client versions prior to 5.18.0
Description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.
maxBodyLebgth was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer.Recommendations
To resolve the issue, update to version 5.18.0 or later.
As a temporary workaround, consider restricting the size of messages received by the RabbitMQ Java client to prevent memory overflow.
Restrict access to the RabbitMQ Java client to minimize the risk of exploitation.
Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Rabbitmq Java Client
Red Os